Configuring the IBM JRE to use FIPS 140-2 approved providers

Describes how to configure the IBM® JRE to use IBM Java™ FIPS 140-2 approved providers

Before you begin

To be FIPS 140-2 approved, all computers running the Rational® ClearQuest® Client must be configured to use the IBM JRE with the IBM Java JCE (Java Cryptographic Extension) FIPS providers enabled. This ensures that the clients use the FIPS 140-2 certified algorithms AES 128-bit and SHA-256.

About this task

Perform the following steps to configure the computers running the Rational ClearQuest Client to use the IBM JRE with the IBM Java JCE FIPS providers enabled.

Procedure

  1. Edit the master security properties file, java.security, to register additional cryptographic package providers:
    On Windows™:
    drive:\install-dir\Program Files\Rational\Common\java\jre\lib\security\java.security
    On the UNIX™ system and Linux™:
    install-dir/Rational/ClearQuest/common/java/jre/lib/security/java.security
  2. Locate the list-of-providers section near the top of the file. This section will look similar to the following example: 
    #
# List of providers and their preference orders:
#
security.provider.1=com.ibm.jsse2.IBMJSSEProvider2
security.provider.2=com.ibm.crypto.provider.IBMJCE
security.provider.3=com.ibm.security.jgss.IBMJGSSProvider
security.provider.4=com.ibm.security.cert.IBMCertPath
security.provider.5=com.ibm.security.sasl.IBMSASL
  3. Add the following providers to the top of the list and sequentially renumber the other providers: 
    security.provider.1=com.ibm.fips.jsse.IBMJSSEFIPSProvider
security.provider.2=com.ibm.fips.crypto.fips.provider.IBMJCEFIPS

    The updated list of security providers will look similar to the following example:

    #
# List of providers and their preference orders:
#
security.provider.1=com.ibm.fips.jsse.IBMJSSEFIPSProvider
security.provider.2=com.ibm.fips.crypto.fips.provider.IBMJCEFIPS
security.provider.3=com.ibm.jsse2.IBMJSSEProvider2
security.provider.4=com.ibm.crypto.provider.IBMJCE
security.provider.5=com.ibm.security.jgss.IBMJGSSProvider
security.provider.6=com.ibm.security.cert.IBMCertPath
security.provider.7=com.ibm.security.sasl.IBMSASL