Release Notes › New Features › FIPS-140 Support

FIPS-140 Support

The SiteMinder Agent supports the Federal Information Processing Standards (FIPS) 140-2 specification. FIPS-140 specifies the requirements for using cryptographic algorithms within a security system protecting sensitive, unclassified data.

SiteMinder can operate in a pre-FIPS mode or in a FIPS-only mode. The cryptographic boundaries, that is, the way SiteMinder applies encryption, are the same in both modes, but the algorithms are different.

In FIPS-only mode, SiteMinder uses the following algorithms:

• AES Key Wrap for key encryption.
• AES in OFB mode (HMAC-SHA 256) for channel encryption.
• AES in CBC mode (HMAC-SHA 224) for encrypting tokens used to facilitate single sign-on.

The SiteMinder Agent makes extensive use of encrypted data, encrypting the following:

• Cookies using an Agent Key retrieved from the Policy Server
• Data sent to the Policy Server using a Session Key
• A Shared Secret using the Host Key. The encrypted Shared Secret is stored in the Host Configuration file.