Tigase cannot use OpenSSL module. It can use only Java Cryptography Extension (JCE) (free or commercial) like Bouncycastle (we have to add configuration option for that). But if non standard JCE is configured as default in VM, then it should be used by Tigase without additional configuration.

Thank you. From the statement "We have to add configuration option" I understand that this new code to support this, or does this option exist today for us to start experiementation?

Sorry for delayed response. To be honest the FIPS stuff was quite new to me, so I had to learn and dive into the topic before responding.

However, it looks like I have good news. Although Tigase (Java) cannot easily use OpenSSL for FIPS compliance, the good news is that Java itself supports FIPS 140-2 mode out of the box.

Which means, Tigase, most likely does support it as well out of the box.

So, it looks like, Tigase can be run in FIPS compliant mode even without using OpenSSL.

I am saying "most likely" because this is something we have not tested before, so we would need to check it out before giving you a definite answer. But this is something, which is enabled on the Java level, therefore, I am pretty sure it will work.

Please check with your client if running Java with FIPS compliance mode is good enough for them, or they really need to use OpenSSL for this. If you confirm than Java with FIPS compliance mode is good enough, we can run tests to confirm that Tigase handles it correctly.

Quick search on the internet returns this link on how to enable FIPS compliance mode in Java: https://docs.oracle.com/middleware/1213/wls/SECMG/fips.htm#SECMG770

Thank you. We'll revert with this for now, and discuss with our FIPS consultant.

Please close ticket.

On 11/27/18, 2:55 PM, "support@tigase.net" support@tigase.net wrote: