CA EEM Getting Started › FIPS 140-2 Support › FIPS 140-2 Overview

FIPS 140-2 Overview

The Federal Information Processing Standards (FIPS) 140-2 publication specifies the requirements for using cryptographic algorithms within a security system protecting sensitive, unclassified data. CA EEM Server embeds Crypto-C ME v2.0 cryptographic library from RSA, which has been validated as meeting the FIPS 140-2 Security Requirements for Cryptographic Modules. The validation certificate number for this module is 608.

CA EEM Java SDK uses a FIPS-compliant version of the BSAFE Crypto-J 4.0 cryptographic library from RSA. CA EEM C++ SDK embeds ETPKI 4.1.x, which uses RSA cryptography libraries.

CA EEM can operate in a non-FIPS mode or in a FIPS-only mode. The cryptographic boundaries, that is, the way CA EEM applies encryption, are the same in both modes, but the algorithms are different.

Computer products that use FIPS 140-2 accredited cryptographic modules in their FIPS-accredited mode can only use FIPS approved security functions such as AES (Advanced Encryption Algorithm), SHA-1 (Secure Hash Algorithm), and higher level protocols such as TLS v1.0 as explicitly allowed in the FIPS 140-2 standard and implementation guides.

In FIPS-only mode, CA EEM uses the following algorithms:

• SHA1 as the default digest algorithm to encrypt passwords and sign server requests. You can use any of the following algorithms in FIPS-only mode:
  • SHA1
  • SHA256
  • SHA384
  • SHA512
• TLS v1.0 for communication with external LDAP directories if the LDAP connection is over TLS.