FIPS 140-3 for Java 8 Feature Test Summary

[jacobwdv]

Test Strategy

The FIPS 140-3 cryptographic security standard from the US government supersedes the previous version, FIPS 140-2 standard. Enabling FIPS 140-3 requires users to add JVM properties to the Liberty server. The JVM contains versions of the IBMJSSE2 and IBMJCEPlusFIPS providers that are updated to use FIPS 140-3 certified cryptography.

Our goal is to enable FIPS 140-3 to Liberty using IBM Java 8. Details about the changes in FIPS are found in this link:
https://www.ibm.com/docs/en/sdk-java-technology/8?topic=guide-fips-140-3

To achieve FIPS 140-3 compliancy we have had to update our LTPA key's cryptographical properties such as encryption algorithm, key length and padding. Details about this change are in the UFO presentation.

Since the 140-3 specification is implemented at the JVM level, every test in our FIPS test pipelines must pass / have the same result as a pipeline with FIPS 140-3 disabled. All tests which supply LTPA keys will need additional FIPS 140-3 keys provided and loaded at test time.

There is no specific feature that comes as part of the FIPS specification that would require new testing. There is no upgrade support go to from no-FIPS or FIPS 140-2 to 140-3. Customers must update their keys and enable FIPS manually.

Only Java 8 pipelines will be run, in the future Java 11+ support will be declared / released. For now the focus is on Java 8.

List of FAT projects affected

• Every FAT is affected

Test strategy

• What functionality is new or modified by this feature? Security configurations are impacted by this feature. For example, use of SHA-1 algorithms will not be FIPS compliant. Functionality which uses SHA-1 algorithms will need to upgrade to at least SHA256. There are no new features per se, there are just updated security parameters.

• What manual tests are there (if any)? We tested a Liberty server from before our changes with one after our changes. Ensuring that the ltpa2 tokens aren't compatible with FIPS 140-3 enabled but when FIPS is disabled they must continue to work.

Confidence Level

2) Collectively as a team you need to assess your confidence in the testing delivered based on the values below. This should be done as a team and not an individual to ensure more eyes are on it and that pressures to deliver quickly are absorbed by the team as a whole.

Please indicate your confidence in the testing (up to and including FAT) delivered with this feature by selecting one of these values:

5 - We have delivered all automated testing we believe is needed for this feature. The testing covers all golden path cases as well as all the error/outlying scenarios that make sense. We are not aware of any gaps in the testing at this time. No manual testing is required to verify this feature.

Our feature is tested by every single pipeline test run with it enabled. That means by the time we release, the pipeline runs must be as stable with FIPS enabled as they are with it disabled.