Skip to content

Disable crypto OS helpers on z/OS in FIPS #1263

@farshadasl

Description

@farshadasl

OS helper functions for hardware crypto (GCM and SymmetricCipher) should be disabled in FIPS mode.

In the line

Add this:

// The OS_Helper functions are not NIST certified, thus they can't be used in FIPS mode.
if (ockContext.isFIPS()) {
    GCMHardwareFunctionPtr = -1;
}

In the line

Add this:

// The OS_Helper functions are not NIST certified, thus they can't be used in FIPS mode.
if (ockContext.isFIPS()) {
    GCMHardwareFunctionPtr = -1;
}

Change the lines 145-151

if (hardwareEnabled.containsKey(ockContext))

To this:

// The OS_Helper functions are not NIST certified, thus they can't be used in FIPS mode.
if (!ockContext.isFIPS()) {
    if (hardwareEnabled.containsKey(ockContext)) {
        isHardwareSupport = hardwareEnabled.get(ockContext);
    } else {
        hardwareFunctionPtr = checkHardwareSupport(ockContext.getId());
        isHardwareSupport = (hardwareFunctionPtr == 1) ? true : false;
        hardwareEnabled.put(ockContext, isHardwareSupport);
    }
}

@gin-nader, could you please apply the above changes to all branches? Thanks

FYI @jasonkatonica

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions