For back channel communication used for HTTP-Artifact single sign-on and SAML 2.0 Single Logout, CA SiteMinder® Federation Standalone supports the following ciphers, depending upon FipsMode:

FIPS_Compat and FIPS_Migration Modes—RC4 and AES

RSA_With_RC4_SHA

RSA_With_RC4_MD5

RSA_With_AES_128_CBC_SHA

RSA_With_AES_256_CBC_SHA

FIPS_Only Mode—AES only

RSA_With_AES_128_CBC_SHA

RSA_With_AES_256_CBC_SHA

Backend Communication Algorithms (SPS Server)

For Backend Communication (SPS-backend server), following ciphers are being supported depending upon FipsMode of the setup. These are defined in <fedroot>\secure-proxy\proxy-engine\conf\server.conf.

FIPS_Compat and FIPS_Migration Modes: ciphers="-RSA_With_Null_SHA,+RSA_With_Null_MD5,-RSA_With_RC4_SHA,+RSA_With_RC4_MD5,+RSA_With_RC2_CBC_MD5,+RSA_With_DES_CBC_SHA,+RSA_With_DES_CBC_MD5,+RSA_With_3DES_EDE_CBC_MD5,+RSA_Export_With_RC4_40_MD5,-RSA_Export_With_DES_40_CBC_SHA,+RSA_Export_With_RC2_40_CBC_MD5,-DH_RSA_With_DES_CBC_SHA,-DH_RSA_With_3DES_EDE_CBC_SHA,-DH_RSA_Export_With_DES_40_CBC_SHA,-DH_DSS_With_DES_CBC_SHA,-DH_DSS_Export_With_DES_40_CBC_SHA,-DH_Anon_With_RC4_MD5,-DH_Anon_With_DES_CBC_SHA,-DH_Anon_With_3DES_EDE_CBC_SHA,-DH_Anon_Export_With_DES_40_CBC_SHA,-DH_Anon_Export_With_RC4_40_MD5,-DHE_RSA_With_DES_CBC_SHA,-DHE_RSA_Export_With_DES_40_CBC_SHA,-DHE_DSS_With_DES_CBC_SHA,-DHE_DSS_Export_With_DES_40_CBC_SHA,-Null_With_Null_Null"
FIPS_ONLY Mode: fipsciphers="+DHE_DSS_With_AES_256_CBC_SHA, +DHE_RSA_With_AES_256_CBC_SHA, +RSA_With_AES_256_CBC_SHA, +DH_DSS_With_AES_256_CBC_SHA, +DH_RSA_With_AES_256_CBC_SHA, +DHE_DSS_With_AES_128_CBC_SHA, +DHE_RSA_With_AES_128_CBC_SHA, +RSA_With_AES_128_CBC_SHA, +DH_DSS_With_AES_128_CBC_SHA, +DH_RSA_With_AES_128_CBC_SHA, +DHE_DSS_With_3DES_EDE_CBC_SHA, +DHE_RSA_With_3DES_EDE

Java SDK Encryption Algorithms

The CA SiteMinder® Federation Standalone Java SDK supports the following encryption algorithms:

Without a Password: "AES/CBC/PKCS5Padding"
With a Password: "PBE/SHA1/AES/CBC/PKCS12PBE-5-128"

Federation System Crypto Algorithm

FMCrypto Encryption/Decryption Algorithm: AES_128

Internal Key Encryption Algorithms

CA SiteMinder® Federation Standalone uses the following internal key encryption/decryption algorithms, depending on the FIPS mode of operation:

FIPS_MIGRATE and FIPS_ONLY Modes: AES_128
FIPS_COMPAT Mode: RC2

SSL Key Algorithms for the Apache Web Server and Administrative UI

CA SiteMinder® Federation Standalone uses the following algorithms for the embedded Apache web server SSL communication:

Apache SSL key generation: SHA1withRSA
Key encryption: DES-EDE3-CBC

CA SiteMinder® Federation Standalone uses the following algorithm for SSL communication to the Administrative UI:

SSL Key password encryption: aes-128-cbc