FIPS Compliance for HPE Data Fabric

Describes how the HPE Data Fabric complies with Federal Information Processing Standard (FIPS) 140-3 Level 1.

Release 7.0.0 and later releases of the HPE Data Fabric provide FIPS compliance with some restrictions.

Considerations for FIPS Support

  • HPE Data Fabric 8.1 has been certified for FIPS 140-3 Level 1 for RHEL 9.2 and 9.6.
    NOTE
    For the certified platforms: RHEL 9.2 and RHEL 9.6, see the certificate #4857.
Note the following important considerations for FIPS support in the release 8.1.0:
  • Release 8.1.0 supports FIPS for new installations only.
  • Upgrades are not supported. You cannot upgrade from a non-FIPS cluster to a FIPS-compliant cluster in release 8.1.0.
  • Some, but not all, EEP components support FIPS. For more information, see What's New in EEP 8.1.0.
  • For manual installations, FIPS mode implies secure mode as well. Thus, on a FIPS-enabled node, -secure is the default.
  • The HPE Data Fabric Object Store is not FIPS compliant.
  • Only the operating systems listed on this page are FIPS compliant for the HPE Data Fabric. Other operating systems either are undergoing testing or will never be FIPS compliant. CentOS 8.x and the newer CentOS Stream, for example, are not FIPS compliant with the HPE Data Fabric. CentOS 8 users who need to run Data Fabric software in a FIPS-validated configuration should migrate to RHEL 8.x.

About FIPS and 140-2/104-3 Level 1

The Federal Information Processing Standard (FIPS) is a US government standard used to approve cryptographic modules. FIPS-validated products give users the assurance that data within the product is protected using cryptographic algorithms meeting the stringent guidelines and testing procedures established by the FIPS standard. FIPS was established by the National Institute of Standards and Technology (NIST), and defines critical security parameters that vendors must use for encryption. Products sold to the US government must meet FIPS validation criteria. In addition, there is a growing need by organizations processing sensitive data, such as banks, financial institutions, legal and medical institutions, to have the products that they use be FIPS 140-2/3 validated.

FIPS 140-3 requires that any hardware and software cryptographic module implement algorithms from an approved list. FIPS-validated algorithms cover both symmetric and asymmetric encryption algorithms as well as the use of hash standards and message authentication. FIPS 140-3 specifies multiple levels of security, with level 1 being the least secure and level 4 being the most secure. In particular, FIPS 140-3 Level 1 compliance is applicable to software-only distributions such as the HPE Data Fabric. FIPS 140-3 Level 2 and above require control of physical security mechanisms, which do not apply to the Data Fabric platform. For more information about the different levels here.

Data Fabric Approach to FIPS Level 1 Compliance

The HPE Data Fabric solution is installed on user-supplied operating systems, with the JDK supplied by the user. HPE Data Fabric does not bundle the operating system or associated libraries, such as OpenSSL, with the products. Neither does it bundle the JDK.

Therefore, the Data Fabric approach to FIPS 140-3 Level 1 compliance is to leverage the operating systems that include FIPS 140-3 Level 1 certified cryptographic libraries provided by the user, as well as support for the Bouncy Castle Java FIPS API bundled with HPE Data Fabric, which runs on a compatible user-supplied JDK. The HPE Data Fabric therefore:
  • Uses the OpenSSL cryptographic module distributed in operating systems supported by the Data Fabric core platform that have obtained FIPS 140-3 Level 1 approval. These include:
    • Red Hat Enterprise Linux 9.2 and 9.6
  • Includes enhancements to the Data Fabric core platform so that all components use only 140-3 Level 1-validated cryptography when FIPS mode is enabled, and ensures that no sensitive data is stored in plain text.

Interoperability in Mixed-Mode Clusters

Both FIPS-compliant and regular installations work seamlessly on a single cluster and across cluster. Interoperability is supported for mixed-mode clusters running a combination of FIPS-compliant and non FIPS-compliant solutions. Thus, there will be no disruption in operations during a rolling upgrade.

Sensitive Data Is Protected

All sensitive data such as key and trust store passwords, as well as CLDB and DARE master keys, will be protected using FIPS 140-3 Level 1 compliant cryptography. No sensitive data such as passwords and keys are stored in plain text.