BC FIPS enabled mode show less supported ciphers than doc claimed.
HC Ping <[email protected]> Thu, 25 Oct 2018 14:01:34 -0500
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <CANKD32mVi_2Gea4kFEToLy9xBkbe_gKqhfuBFbRDsTbzn1-oBA@mail.gmail.com> |
Hello,
I was not able to find fip email list, so pasting here.
I am using bcfips/bcjsse provider.
Security.insertProviderAt(new BouncyCastleFipsProvider(), 1);
Security.insertProviderAt(new BouncyCastleJsseProvider("fips:BCFIPS"), 2);
With RSA key and certificate Signature Algorithm sha256WithRSAEncryption,
with fips I saw only 4 TLS_ECDHE_RSA_xxx ciphers:
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
But according to
https://downloads.bouncycastle.org/fips-java/BC-FJA-(D)TLSUserGuide-1.0.0.pdf,
I think those TLS_RSA_WITH_xxx should also be OK, such as
TLS_RSA_WITH_AES_256_CBC_SHA256. Any idea why I didn't see it? Anyway to
turn it on?
Thanks
Huican