Is Solaris 10 apache package fips-140-2 compatible?

I've been going around and around with a remote sys admin that insists that we use the Solaris 10 apache package for our webserver. At first glance, it does not appear to be fips compatible. He points to the "crypt" command as being compatible and therefore concludes that apache is too. If apache has been updated to use newer OpenSSL it could be but the Solaris 10 included OpenSSL is version 0.9.7d which does not appear to include SHA-256 or other fips hashes.

Hi,
for a FIPS-140 version of OpenSSL libraries you need to update to at least Solaris 11.2.
Regards,
Ronald

Similar Messages

SunJCE compliant to FIPS-140-2 standard or not?

Hi Folks,
I am using encryption/ decryption (DES and AES) in my project .
For that I am using javax.crypto and javax.crypto.spec package and the security provider used is SUNJCE.
Please let me know whether JDK is compliant to the FIPS 140-2 standard or not. If it is compliant , also let me know from which version of JDK onwards it will compliant to that standard.
Look forward your reply soon.
Thanks
R.Ravikumar

Hi ,
Thanks for your immediate response. I really appriciate that.
I search in the google and found that IBM's versions of JSSE and JCE have been FIPS 140-2 certified, and are FIPS 140-2 compliant.
I can see the same in the below link
http://csrc.nist.gov/cryptval/140-1/1401vend.htm
And I didn't see the SunJCE in the above link and it seems that Sun's versions of JSSE and JCE are not FIPS 140-2 cmpliant.
Also I see the link which you have pointed out in the earlier, it seems JCE of JDK1.6 is compliant to FIPS 140-2.
I am really confused, Please let me know your thoughts on that.
Look forward your response.
Thanks
R.Ravikumar

Are JSSE or JCE FIPS 140 compliant ?

I have looked throught as much documentation as I can handle trying to find out if these packages are FIPS 140 compliant. I cannot find anything. I have looked at the web page http://csrc.nist.gov/cryptval/140-1/140val-all.htm and do not see anything from Sun as being approved. This is unfortunate and suprising to me that Sun has not put their own code through the approval process. Therefore I am unable to use the JSSE and JCE, and must use RSA BSAFE, which costs a fortune.
Can anyone shed some light on this topic.
...Thank you.
Mark

I looked into this issue extensively last fall as we have a requirement
to use a NIST certified encryption algorithm. At that time, the
descriptions of Cert#s 247 & 248 in the table at
http://csrc.nist.gov/cryptval/140-1/140val-all.htm looked very
different. In fact, a reference to
http://www.mozilla.org/projects/security/pki/nss/ appeared in the
description as a means of obtaining a copy of NSS. I downloaded a
version of NSS and attempted to use it (along with the JSS package
also available at the mozilla site). After experimenting with NSS and
JSS for some time, I just could not get it to work (can't recall now
exactly what the issues were at that time).
We abandoned the NSS approach with the expectation of obtaining a
temporary exemption of this requirement; however, this requirement has
now come full circle and is back on my plate. If we have to purchase
a third-party tool, so be it; however, it would sure be nice to hear
from the source exactly what, if anything, is occurring with regards
to NIST certification. Thanks.
-Mark
I have looked throught as much documentation as I can
handle trying to find out if these packages are FIPS
140 compliant. I cannot find anything. I have looked
at the web page
http://csrc.nist.gov/cryptval/140-1/140val-all.htm and
do not see anything from Sun as being approved. This
is unfortunate and suprising to me that Sun has not
put their own code through the approval process.
Therefore I am unable to use the JSSE and JCE, and
must use RSA BSAFE, which costs a fortune.
Can anyone shed some light on this topic.
...Thank you.
Mark

Java 8 64 bit on Windows with NSS for FIPS 140 compliance

I have asked this question on Stackoverflow but I am beginning to think that this may be a better forum to ask.
According to JEP 131, Java 8 should provide a PKCS#11 Crypto provider for 64 bit Windows: https://blogs.oracle.com/mullan/entry/jep_131_pkcs_11_crypto.
With that in mind, I downloaded and built both 32 and 64 bit versions of NSS with NSPR using these instructions: https://developer.mozilla.org/en-US/docs/NSS_Sources_Building_Testing
I downloaded Java 8 for Windows 64 build b118, configured the java.security file and created a nss.cfg file:
Excerpt from java.security file:
security.provider.1=sun.security.provider.Sun
security.provider.2=sun.security.rsa.SunRsaSign
security.provider.3=sun.security.ec.SunEC
security.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS
security.provider.5=com.sun.crypto.provider.SunJCE
security.provider.6=sun.security.jgss.SunProvider
security.provider.7=com.sun.security.sasl.Provider
security.provider.8=org.jcp.xml.dsig.internal.dom.XMLDSigRI
security.provider.9=sun.security.smartcardio.SunPCSC
security.provider.10=sun.security.pkcs11.SunPKCS11 /devel/nss.cfg
From my nss.cfg file:
# Use NSS as a FIPS-140 compliant cryptographic token
# SunPKCS11-NSS
name = NSS
#32 bit
#nssLibraryDirectory = C:\devel\nss\nss-3.15.3.1\dist\WINNT6.1_DBG.OBJ\lib
#64 bit
nssLibraryDirectory = C:\devel\nss\nss-3.15.3.1\dist\WINNT6.1_64_DBG.OBJ\lib
#non FIPS
#nssDbMode = noDb
#attributes = compatibility
#FIPS
nssSecmodDirectory = c:\devel\fipsdb
nssModule = fips
I ran the test suite that comes with NSS and it looks like all of the encryption/decryption tests passed (did have some issues with the tests that required hostname/domainname but that has to do with the Windows environment).
So here is the problem. I run my test encryption app on Java 7 32 bit with the 32 bit version of NSS and everything works great. When I attempt to run Java 8 64 bit with 64 bit NSS I get the following error:
java.security.ProviderException: Could not initialize NSS
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:212)
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:103)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at sun.security.jca.ProviderConfig$2.run(Unknown Source)
at sun.security.jca.ProviderConfig$2.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.jca.ProviderConfig.doLoadProvider(Unknown Source)
at sun.security.jca.ProviderConfig.getProvider(Unknown Source)
at sun.security.jca.ProviderList.getProvider(Unknown Source)
at sun.security.jca.ProviderList.getIndex(Unknown Source)
at sun.security.jca.ProviderList.getProviderConfig(Unknown Source)
at sun.security.jca.ProviderList.getProvider(Unknown Source)
at java.security.Security.getProvider(Unknown Source)
at sun.security.ssl.SunJSSE.<init>(Unknown Source)
at sun.security.ssl.SunJSSE.<init>(Unknown Source)
at com.sun.net.ssl.internal.ssl.Provider.<init>(Unknown Source)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at sun.security.jca.ProviderConfig$2.run(Unknown Source)
at sun.security.jca.ProviderConfig$2.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.jca.ProviderConfig.doLoadProvider(Unknown Source)
at sun.security.jca.ProviderConfig.getProvider(Unknown Source)
at sun.security.jca.ProviderList.getProvider(Unknown Source)
at sun.security.jca.ProviderList$ServiceList.tryGet(Unknown Source)
at sun.security.jca.ProviderList$ServiceList.access$200(Unknown Source)
at sun.security.jca.ProviderList$ServiceList$1.hasNext(Unknown Source)
at javax.crypto.KeyGenerator.nextSpi(KeyGenerator.java:323)
at javax.crypto.KeyGenerator.<init>(KeyGenerator.java:158)
at javax.crypto.KeyGenerator.getInstance(KeyGenerator.java:208)
at STSAESEncryption.generateKeyWithGenerator(STSAESEncryption.java:74)
at Main.main(Main.java:24)
Caused by: java.io.IOException: %1 is not a valid Win32 application.
at sun.security.pkcs11.Secmod.nssLoadLibrary(Native Method)
at sun.security.pkcs11.Secmod.initialize(Secmod.java:210)
at sun.security.pkcs11.SunPKCS11.<init>(SunPKCS11.java:207)
... 36 more
Has JEP 131 been implemented with Windows/Java 64 bit as of b119? If so has it been verified to work with NSS or should I submit a bug report? I did download the code and the error is occurring in the following block of code at the line in bold (also with the arrow by it):
public synchronized void initialize(DbMode dbMode, String configDir,
        String nssLibDir, boolean nssOptimizeSpace) throws IOException {
        if (isInitialized()) {
            throw new IOException("NSS is already initialized");
        if (dbMode == null) {
            throw new NullPointerException();
        if ((dbMode != DbMode.NO_DB) && (configDir == null)) {
            throw new NullPointerException();
        String platformLibName = System.mapLibraryName("nss3");
        String platformPath;
        if (nssLibDir == null) {
            platformPath = platformLibName;
        } else {
            File base = new File(nssLibDir);
            if (base.isDirectory() == false) {
                throw new IOException("nssLibDir must be a directory:" + nssLibDir);
            File platformFile = new File(base, platformLibName);
            if (platformFile.isFile() == false) {
                throw new FileNotFoundException(platformFile.getPath());
            platformPath = platformFile.getPath();
        if (configDir != null) {
            File configBase = new File(configDir);
            if (configBase.isDirectory() == false ) {
                throw new IOException("configDir must be a directory: " + configDir);
            File secmodFile = new File(configBase, "secmod.db");
            if (secmodFile.isFile() == false) {
                throw new FileNotFoundException(secmodFile.getPath());
        if (DEBUG) System.out.println("lib: " + platformPath);
--->   nssHandle = nssLoadLibrary(platformPath);
        if (DEBUG) System.out.println("handle: " + nssHandle);
        fetchVersions();
        if (supported == false) {
            throw new IOException
                ("The specified version of NSS is incompatible, "
                + "3.7 or later required");
        if (DEBUG) System.out.println("dir: " + configDir);
        boolean initok = nssInitialize(dbMode.functionName, nssHandle,
            configDir, nssOptimizeSpace);
        if (DEBUG) System.out.println("init: " + initok);
        if (initok == false) {
            throw new IOException("NSS initialization failed");
        this.configDir = configDir;
        this.nssLibDir = nssLibDir;
Any help or advise about filing a bug report would be appreciated.
Thanks,

Had a few similar short system freezes, after installing Windows 8 x64 on 13” MacBook Pro Mid-2010 with BootCamp 5.0.5033.
There is a suggestion that DisableDynamicTick may fix the problem: https://discussions.apple.com/message/21565295#21565295. There were similar topics at Microsoft forums: 1, 2, 3. It was said “that this will likely reduce system battery life, so it should be undone when you update your Windows build or if it doesn't resolve your issue”, and that “this problem is resolved in the release versions of Windows 8”.
Another possibility is that there is indeed a buggy driver, within BootCamp 5.0.5033, or a 3rd party, like a wireless network driver in the following case http://answers.microsoft.com/en-us/windows/forum/windows_8-performance/system-fr eeze-randomly-after-installing-windows-8/49488183-26cf-4389-af21-a85dc366c99a?pa ge=2#LastReply.
The problem has been noticeable on my MacBook, but not annoying enough yet to spend time troubleshooting. If you find a robust solution, using the links above or other method, it would be interesting to know.
HTH

How to change the Windows Registry to enable FIPS 140 in Acrobat Pro XI?

Is there a set of instructions that identifies the registry key to enable FIPS 140?

http://www.adobe.com/devnet-docs/acrobatetk/tools/PrefRef/Windows/AVGeneral.html#FIPSCompl iance
Also some general info: 2 Pre-deployment Configuration — Digital Signatures Guide for IT
hth,
Ben

FIPS 140-2 encryption for Acrobat 9 Pro on Mac?

I wonder if anyone can help? I need to send documents using the FIPS 140-2 standard. Is this possible on Mac I read somewhere that it isn't!! I don't want to buy another piece of software (i.e. PGP). Any suggestions? Needs to be fairly step by step help.
Many thanks.
RuralTim

FIPS for Acrobat is indeed a Windows only feature.
see page 112 of this pdf: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3993&promoid=DTEHS
Can only suggest to setup a vm image of windows and download a trial of either Acrobat Pro 9 or APEX for inwdows and do it there.

Problem with inbuilt Solaris Apache Web Server v 2.0.58

Hi,
Set-up:
We are working on a custom application which works with the inbuilt Apache Web Server on the Sun Solaris platform. Here are the details of the versions of the various components involved:
Apache Web Server: Version 2.0.58
Platform: SunOS 5.10 Generic_127111-03
Our application is in the form of a shared library(.so binary) which is loaded into the Apache Web Server by mentioning the following directive in the Apache Web Server's configuration file (httpd.conf).
LoadModule at_module "/var/apache2/logs/sample/sample.so"
where, sample.so is our application's binary
and at_module is the name of the module.
httpd.conf file has been attached for your reference.
Attachments:
httpd.conf - Apache Web Server's configuration file.
sample-apache.cpp - Sample program which is showing the problem.
httpd.h - Apache Software Foundation's file which contains the structure "request_rec" that represents the current request.
Problem summary:
For each request to the Apache Web server, the server maintains a table of type "apr_table_t" which contains the header environment from the request. There is a structure "request_rec" maintained in the httpd.h file:
/** A structure that represents the current request */
struct request_rec {
/** The pool associated with the request */
apr_pool_t *pool;
/** Request method (eg. GET, HEAD, POST, etc.) */
const char *method;
/** MIME header environment from the request */
apr_table_t *headers_in;
In our case, when we try to retrieve the address of "headers_in", we get a NULL Value. Please refer to the attached "sample-apache.cpp" program. In this program, inside the access_checker() method, we try to retrieve the address of "headers_in" and get that as NULL:
extern "C" int access_checker(request_rec *r)
     FILE * fp;
     fp = fopen("/var/apache2/logs/sample.txt", "a");
     fprintf(fp, "\n r->headers_in = %u, r->method = %s", r->headers_in, r->method);
     fclose(fp);
     return OK;
Here is the output of the sample program after accessing the main page of the Web server:
r->headers_in = 0, r->method = GET
r->headers_in = 0, r->method = GET
r->headers_in = 0, r->method = GET
Though we are able to retrieve one member of the structure request_rec (method), we are not able to retrieve the address of the other member (headers_in).
Observation:
We made an interesting observation that when we used the same sample program with the inbuilt Apache 2.0.52 Web Server on Solaris, we were able to successfully retrieve the address of headers_in. Here are the details of the set-up which is working fine:
Apache Web Server: Version 2.0.52
Platform : SunOS 5.10 Generic_118822-30
Thus, there is something different which has happened between the Sun's Solaris Apache Web Server's versions 2.0.52 and 2.0.58 which is making it unable to retrieve the address of the request headers (headers_in).
I am requesting someone to kindly shed light on this difference and let us know if we need to change the way of retrieving the request headers for Solaris Apache 2.0.58.
Thanks,
Atul.

The only way you can achieve it is by running the web server to listen on port 80
Please change the port in your httpd.conf file for the webserver and restart it.
If any other processes are running/using on port 80 on that machine, then please stop them, otherwise you will not be able to achieve your requirement.
Arun

Is DBMS_CRYPTO FIPS 140-2 certified?

Sadly, I think that the answer is no. I am hoping someone more knowledgeable can contradict me. This link describes the Oracle Database FIPS certification status.
http://www.oracle.com/technology/deploy/security/seceval/oracle-fips140-validations.html.
This is the linked to certificate which applies to Oracle Cryptographic Libraries for SSL.
http://www.oracle.com/technology/deploy/security/seceval/pdf/140crt861.pdf
I have found nothing that includes DBMS_CRYPTO under Oracle Cryptographic Libraries for SSL. This link might imply that it is not, but I am unclear what might apply to DBMS_CRYPTO.
http://www.oracle.com/technology/deploy/security/as_security/sslfipsfaq_r1.html
Is Oracle Advanced Security’s SSL adapter also included in this FIPS evaluation?
No. Oracle SSL libraries that is only included in Oracle Application Server 10g (9.0.4) alone has received this FIPS 140-2 certification. We are considering evaluation of the Oracle SSL libraries included in the Oracle Database at the earliest.
So in summary, it appears that Oracle has gone through the work to certify the Java libraries, but not the PL/SQL library.
TIA
Edited by: rmonical on May 26, 2009 4:12 PM

The best source of Oracle online documentation is http://tahiti.oracle.com.
If you go there and search, I did it under 10gR2, for "FIPS" you will find a tremendous amount of material with respect to the Oracle Database and FIPS.
And unless I misunderstand your question you are totally incorrect.
The Oracle database is in full compliance with FIPS 127-2.

Time Table for File Vault 2 FIPS-140-2 Certification

I believe I read something that Lion/File Vault 2 encryption was submitted to NIST for FIPS-140-2 certification. I know that IOS 5 is first to be certified, but does anyone know the time table for Lion/File Vault 2 to be certified? I was told a few months ago that it would be certified by 12/31/2011. Any update would be appreciated.

Disclosure: I work for NIST, but not in the Computer Security Div. (the group that issues the certificates).
Looking at the NIST list of validated modules, Lion's crypto module recieved its certification on 3/30/12, but I don't know if this applies to all apps or just the libraries. It doesn't apply to 3rd party apps yet (note says it will be re-evaluated for that use). I wouldn't think File Vault is a "third party" app.
I'll post more if I find out anything.

Error when installing certificate - FIPS-140 compliance.

Hi,
I am having an issue installing a certificate on my LaserJet M750 printer. The error is: "The cryptographic algorithms used in the ID or CA certificate do not comply with FIPS-140."
We can recreate the issue by:
converting cert and key to pfx
selecting "Networking"
login
selecting "Certificates"
selecting "Configure under Jetdirect Certificate".
selecting "Import Certificate and Private Key".
selecting "Browse" and choosing converted pfx file.
provide password and select finish.
Any help is greatly appreciated. I can provide more information if necessary.
Thanks!
BL

If your phone doesn't work (can't turn on), try a hard reset.Turn off your phone. Press and hold three keys together, the green, the * key, and the number 3.Then turn on your phone and don't let the keys before you see the nokia hands logo (or the formatting screen).
If you want to thank someone, just click on the blue star at the bottom of their post

Mountain Lion finally FIPS 140-2 approved

I have seen no press coverage about this nor mention here in the forums, nor announcement by Apple. Perhaps even Apple are as yet unaware of this
Mountain Lion and iOS 6 have both finally received offical FIPS 140-2 certification. You can see this by going to the following page and searching for Apple.
http://csrc.nist.gov/groups/STM/cmvp/documents/140-1/140val-all.htm
This should mean it is now possible to use FileVault2 instead of third-party equivalents such as PGP or CheckPoint or Sophos or WinMagic.
(Have I got a news scoop here )
PS. The following article will also be important - http://support.apple.com/kb/ht5396

NSS is a set of security libraries written in C so you can certainly use C APIs to access it as well. JSS is the Java interface to NSS. You can either use the JSS API directly or use Sun's PKCS11 wrapper which gives you access to most of the NSS functionalities.

Is PhoneFactor compliant with FIPS 140-2 Security Level 1?

Hi, I'm looking for a "hard token" two-factor authentication solution for a medical application. I have a firm external requirement that the hard token used must "meet FIPS 140-2 Security Level 1 for cryptographic devices."
Given that a cell phone is not a cryptographic device, per se, can I assume that use of PhoneFactor would not meet this requirement? Or would it?
Thanks,
-Dennis

Windows Azure Multi-Factor Authentication (formerly PhoneFactor) has not been FIPS 140-2 certified because FIPS 140-2 doesn't apply to the solution.
Has there been any updates on expanding Azure and getting it FIPS 140-2 certified?

Which Agent(s) are in the Solaris 8 Package?

Hi!
Can anybody tell me which Agent(s) are available in the complete Sun Solaris 8 package?
Best regards,
cAner

Hi,
Have you checked the link:
http://docs.sun.com/ab2/coll.47.11/SEAUG/@Ab2TocView?Ab2Lang=C&Ab2Enc=iso-8859-1
This has detailed information on this subject. Please let me
know if you have any specific question.
Hope this helps.
Thanks,
Gopinath.

ILOM and FIPS 140-2 encryption

Is it possible to configure Sun Integrated Lights Out Manager v3 to use encryption algorithms that are certified as FIPS 140-2 compliant?

FIPS for Acrobat is indeed a Windows only feature.
see page 112 of this pdf: http://www.adobe.com/support/downloads/detail.jsp?ftpID=3993&promoid=DTEHS
Can only suggest to setup a vm image of windows and download a trial of either Acrobat Pro 9 or APEX for inwdows and do it there.

Which Solaris 10 package to install that have libgobject-2.0.so.0

Need to install the Solaris 10 package that have libgobject-2.0.so.0.Which package to download? Thank you.

Hi.
Package SUNWgnome-base-libs. It's included to Solaris 10 DVD media.
(/usr/lib/sparcv9/libgobject-2.0.so.0 ; /usr/lib/libgobject-2.0.so.0 ; realy it's link to corresponded libgobject-2.0.so.0.400.1 )
Regards,
Nik.

Is Solaris 10 apache package fips-140-2 compatible?

Similar Messages

Maybe you are looking for