Re: BC FIPS enabled mode show less supported ciphers than doc claimed.

The cipher suites available in FIPS mode are dictated by:

https://csrc.nist.gov/publications/detail/sp/800-52/rev-1/final

You'll find the acceptable ones in Section 3.3.1 starting on page 14.

I think BC provides full coverage, other than the GCM ones which can't
be supported. The additional RSA ones are not on the accepted list
though, so that is why they are missing.

Regards,

David

On 26/10/18 6:01 am, HC Ping wrote:
> Hello,
>
> I was not able to find fip email list, so pasting here.
>
> I am using bcfips/bcjsse provider.
>   Security.insertProviderAt(new BouncyCastleFipsProvider(), 1);
>   Security.insertProviderAt(new
> BouncyCastleJsseProvider("fips:BCFIPS"), 2);
>
> With RSA key and certificate Signature Algorithm
> sha256WithRSAEncryption, with fips I saw only 4 TLS_ECDHE_RSA_xxx ciphers:
>   TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
>   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
>   TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
>   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
>
> But according to
> https://downloads.bouncycastle.org/fips-java/BC-FJA-(D)TLSUserGuide-1.0.0.pdf,
> I think those TLS_RSA_WITH_xxx should also be OK, such as
> TLS_RSA_WITH_AES_256_CBC_SHA256. Any idea why I didn't see it? Anyway
> to turn it on?
>
> Thanks
> Huican